Security vulnerabilities

Attached to Project: Security vulnerabilities
Opened by monty099 - 10.08.2026
Last edited by hdegorce - 18.08.2026

Severity: Critical

Description

There is a logic flaw in the domain transfer workflow that allows a previously created transfer request to remain valid and executable even after the domain has already been transferred to another user.

The application does not invalidate or revalidate pending transfer requests when the domain’s ownership or state changes. As a result, an attacker can create a transfer request targeting an email address they control, retain this request, and then allow the domain to be legitimately transferred to the victim’s account.

After the transfer is completed, the previously created transfer request remains valid. The attacker can therefore use it at a later time to transfer the domain from the victim’s account to an account controlled by the attacker.

In other words, the attacker can retain a persistent path to take over the domain even after the domain has become owned by the victim.

Steps to Reproduce

  Create a domain from an attacker-controlled account.
  Navigate to Domain Settings → DNSSEC.
  Toggle the DNSSEC status between Active and Deactivated approximately 6 times.
  Create a transfer request for the domain to another account controlled by the victim.
  Have the victim accept the transfer request.
  During the short period before the transfer state is fully reflected, the attacker cancels the visible transfer request.
  The attacker immediately creates another transfer request for the domain to an email address they control.
  The transfer request accepted by the victim is processed, and the domain reaches the victim’s account.
  Despite the domain ownership having been transferred to the victim, the previously created transfer request by the attacker remains valid and usable.
  The attacker can later accept the old transfer request, causing the domain to be transferred from the victim’s account to the attacker’s account.

POC: https://admin.alwaysdata.com/support/95089/

Impact

The vulnerability results in unauthorized domain takeover with a persistent path to regain control of the domain.

The issue is not merely temporary access or unauthorized modification of a transfer request; the attacker can retain a valid transfer request that can be used later, even after ownership of the domain has been legitimately transferred to the victim.

After the domain is transferred to the attacker’s account, they can control the resources hosted on or associated with the domain, including, depending on the resources associated with it:

  The website associated with the domain.
  DNS configuration.
  Email addresses and mailboxes.
  Mailing Lists.
  Users associated with the domain.
  Databases and other resources associated with the domain.

Therefore, the ultimate impact is complete loss of domain ownership and control over the hosted infrastructure and resources associated with it, rather than merely manipulating a transfer request.

Suggested Remediation

Transfer Requests should be treated as stateful, single-use transactions and must not remain valid after the domain’s ownership or transfer state changes.